Logging at session start enabled on Palo Alto Networks devices misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_PAN_16
Category - Subcategory	Public Exposure - Encryption And Protocols
Provider	OTHER
Severity	LOW
Framework	Ansible

Impact

This rule detects whether logging at the start of a session is enabled on Palo Alto Networks devices. While logging at session start can provide detailed insights for troubleshooting or monitoring specific long-lived GRE tunnel connections, it typically generates a large volume of logs and can lead to resource consumption issues.

How to Fix

Resource: panos_security_rule

• Attribute: description

To mitigate this issue, ensure that every panos_security_rule resource contains a descriptive description attribute. This description should offer clear and concise information about the rule's purpose, facilitating effective management and documentation of security policies.

Secure Code Example:

In this example, including meaningful descriptions in your security rules clarity and manageability of your security policies. [source,go]

• name: Example tasks:

  • name: Example paloaltonetworks.panos.panos_security_rule: ...
•    description: "Block traffic from untrusted zones to critical servers"

---